Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53e1fadebd2380f5bf8e978805cb5894.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
53e1fadebd2380f5bf8e978805cb5894.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
53e1fadebd2380f5bf8e978805cb5894.exe
-
Size
75KB
-
MD5
53e1fadebd2380f5bf8e978805cb5894
-
SHA1
1c680a822abaaf3a51920784817b5952e6cac7e3
-
SHA256
ec514956a3205edb1563469b186ab9f84149bd511e66537fcdf235bdb97d09f6
-
SHA512
f97bb9753fe1c82cc7c3a9b093d571c815618c9b6ee9805de7f4152a1329e863c556d6aae47839525a45fd501daf00bdc095d01efa85f7a56adc1fd4b473a8ce
-
SSDEEP
1536:M3isq3QFioUa9+b1tFhHDtJk+Px9zMNkXV/3CsOaNo:HMl41P3Jk+Px9zMCXQaNo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2736 53e1fadebd2380f5bf8e978805cb5894.exe.exe -
Loads dropped DLL 2 IoCs
pid Process 2444 53e1fadebd2380f5bf8e978805cb5894.exe 2444 53e1fadebd2380f5bf8e978805cb5894.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\7-Zip\7zG.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 53e1fadebd2380f5bf8e978805cb5894.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 53e1fadebd2380f5bf8e978805cb5894.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\system\svchost.exe 53e1fadebd2380f5bf8e978805cb5894.exe File opened for modification C:\Windows\system\svchost.exe 53e1fadebd2380f5bf8e978805cb5894.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2736 2444 53e1fadebd2380f5bf8e978805cb5894.exe 28 PID 2444 wrote to memory of 2736 2444 53e1fadebd2380f5bf8e978805cb5894.exe 28 PID 2444 wrote to memory of 2736 2444 53e1fadebd2380f5bf8e978805cb5894.exe 28 PID 2444 wrote to memory of 2736 2444 53e1fadebd2380f5bf8e978805cb5894.exe 28 PID 2444 wrote to memory of 2772 2444 53e1fadebd2380f5bf8e978805cb5894.exe 29 PID 2444 wrote to memory of 2772 2444 53e1fadebd2380f5bf8e978805cb5894.exe 29 PID 2444 wrote to memory of 2772 2444 53e1fadebd2380f5bf8e978805cb5894.exe 29 PID 2444 wrote to memory of 2772 2444 53e1fadebd2380f5bf8e978805cb5894.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\53e1fadebd2380f5bf8e978805cb5894.exe"C:\Users\Admin\AppData\Local\Temp\53e1fadebd2380f5bf8e978805cb5894.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\53e1fadebd2380f5bf8e978805cb5894.exe.exeC:\Users\Admin\AppData\Local\Temp\53e1fadebd2380f5bf8e978805cb5894.exe.exe2⤵
- Executes dropped EXE
PID:2736
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "load" /t reg_sz /d "C:\Windows\system\svchost.exe" /f2⤵PID:2772
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195KB
MD5e4f28a7d0c89afc04ace82bd7d0bacbd
SHA12eb60c52f2a6569a28bed3ca934a11893bad511e
SHA256499d0f47d4447f7576c4568da9eaa1f38d27a0753559e5d3c8c1c1ac086294eb
SHA51238a88ab28a2fe03d7c0f2063ca78fbce28c1a7b92ce5c05bedfc4666133ce7397bb884dbee84270b6e3912d6c6c2f500bab77e634007535aa7dbe46f97d5dc59
-
Filesize
25KB
MD520302bdd9014907685cb8a480534e509
SHA102a9e9b31f6947541374690a52dcfb77a7098a85
SHA256e97942c4844f95818c3a4f6a7997e1b1583459a257fea32b73bb0868530bfe43
SHA5123b4360e40eff478b6eef9ee0dde032e348e4c32a27a2048d1a4c8c0dfce68389dbd031e96af37edf2d9411a70bfe166e55e26a25b633b62f7e42467c923f286f